The Patching Friars' AlmanacA calendar of CVE saints

February 6

BlueFragHoly card for bluefrag, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 BlueFrag FRUSTRA FRUSTULA
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint BlueFrag, Who Arrived in Pieces

Patron of Bluetooth left switched on, fragmented packets, and phones that no longer get updates.

Life

On 6 February 2020 Jan Ruge of ERNW described CVE-2020-0022, a miscalculation in the Android code that reassembles fragmented Bluetooth packets. On Android 8 and 9, knowing the phone's Bluetooth address was enough, with Bluetooth switched on, to run code without any interaction; on Android 10 the flaw merely crashed the Bluetooth service. Google fixed it in the February 2020 bulletin.

Prayer

O Saint BlueFrag, who arrives in pieces and reassembles where he shouldn't, remind us to turn Bluetooth off when we don't need it. Amen.

How to celebrate

Celebrated by installing the February 2020 Android security patch or, for phones their maker abandoned, keeping them undiscoverable.

Small fragment, whole damage.

Technical record

Disclosed on
February 6 2020
CVE
CVE-2020-0022
CVSS
8.8
Product
Android

In reassemble_and_dispatch of packet_fragmenter.cc, there is possible out of bounds write due to an incorrect bounds calculation. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-143894715

Sources: insinuator.net

Also remembered today

Shortcuts: ← → to move, D day, W week, M month, T today.

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.